impel-cli 0.20.63-canary.6 → 0.20.63

package/README.md

@@ -219,7 +219,7 @@ skill-catalog prompt context; the selected Eve agent still performs the
 substantive work. Model, profile,
 developer-instruction, MCP, approval, sandbox, and feature overrides are
 rejected for its managed path. Ordinary `impel claude`, user-authored Claude
-agent, and `impel codex` passthrough are unchanged.
+agent, and `impel codex` are unchanged.
 
 ## Remote Fargate sessions
 

package/RELEASE_NOTES.md

@@ -1,5 +1,19 @@
 # Release notes
 
+## 0.20.63 — Route isolated Codex through the typed gateway surface
+
+- Moves the `impel codex` and `impel use gateway codex` model provider from the
+  raw `/chatgpt_passthrough/backend-api/codex` route to `/openai/v1`, the typed
+  OpenAI-compatible surface the managed ChatGPT desktop profile already uses.
+  The raw route forwards bytes to chatgpt.com and can only serve Codex-native
+  models; every OpenAI-compatible subscription model (MiniMax, GLM, Qwen)
+  answered `400 model is not available on this client protocol` there.
+  Cross-app mode no longer switches routes; it only changes the catalog.
+- Pins `supports_websockets = false` on every generated Codex provider block.
+  Without it Codex dials `wss://…/responses` first and retries the handshake
+  five times per turn, showing each gateway refusal to the user, before falling
+  back to HTTPS. Bumps the managed config version so existing profiles rewrite.
+
 ## 0.20.62 — Silence the Codex apps connector in desktop profiles
 
 - Persists `features.apps = false` in the managed ChatGPT desktop `config.toml`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.20.63-canary.6",
+  "version": "0.20.63",
   "description": "Prepare isolated Claude and Codex workspaces for every accessible Impel tenant",
   "type": "module",
   "bin": {

package/src/cli.js

@@ -34,7 +34,6 @@ import {
   TELEMETRY_FLUSH_COMMAND,
 } from "./posthog.js";
 import { maybePrintTelemetryNotice } from "./telemetryNotice.js";
-import { versionLine } from "./runtimeBrand.js";
 
 const HELP = `impel — isolated Impel workspaces for every tenant
 
@@ -94,7 +93,7 @@ Config file:
 function printVersion() {
   const pkgPath = fileURLToPath(new URL("../package.json", import.meta.url));
   const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
-  console.log(versionLine(pkg.version));
+  console.log(pkg.version);
 }
 
 // Accepts "claude" | "codex" | "all" | undefined; returns a normalized target

package/src/cliProfiles.js

@@ -208,13 +208,16 @@ function codexManagedBlock(gatewayUrl, tenantId, { crossAppModels = false } = {}
     `# Generated for \`${RUNTIME_BRAND.cli.command} codex\`. Other profile settings outside this block are preserved.`,
     `[model_providers.${providerId}]`,
     `name = ${JSON.stringify(`${RUNTIME_BRAND.product.displayName} Gateway`)}`,
-    // The experimental OpenAI-compatible route can dispatch both provider
-    // families (the desktop ChatGPT profile's cross-app path); the default
-    // route is the byte-preserving Codex passthrough.
-    `base_url = ${JSON.stringify(crossAppModels
-      ? `${gatewayUrl}/experimental/openai/v1`
-      : impelCodexBaseUrl(gatewayUrl))}`,
+    // The typed OpenAI-compatible route serves Codex-native and every
+    // OpenAI-compatible subscription model, and is what the managed ChatGPT
+    // desktop profile already uses. Cross-app mode only changes which models
+    // the catalog lists, not the route. The old byte-preserving Codex
+    // passthrough could serve Codex-native models only.
+    `base_url = ${JSON.stringify(impelCodexBaseUrl(gatewayUrl))}`,
     'wire_api = "responses"',
+    // HTTPS only: without this Codex retries a wss:// handshake five times
+    // per turn before falling back.
+    "supports_websockets = false",
     `env_key = ${JSON.stringify(CODEX_GATEWAY_TOKEN_ENV)}`,
   ];
   if (RUNTIME_BRAND.features.mcp) {

package/src/codexSetup.js

@@ -39,11 +39,16 @@ export const CODEX_CONFIG_PATH = path.join(CODEX_HOME, "config.toml");
 
 export const PROVIDER_ID = RUNTIME_BRAND.cli.providerId;
 
-// Genuine Codex CLI traffic has its own byte-preserving compatibility route.
-// With wire_api = "responses", Codex POSTs to `${base_url}/responses`, so this
-// base must stop immediately before that suffix. Do not point the CLI at the
-// separate `/v1/responses` SDK front door; the gateway may shape that body.
-export const CODEX_CLI_BASE_PATH = "/chatgpt_passthrough/backend-api/codex";
+// Codex CLI traffic uses the gateway's typed OpenAI-compatible surface, the
+// same route the managed ChatGPT desktop profile uses. With
+// wire_api = "responses", Codex POSTs to `${base_url}/responses`, so this base
+// must stop immediately before that suffix. The old raw
+// `/chatgpt_passthrough/backend-api/codex` route forwards bytes to chatgpt.com
+// and can only serve Codex-native models: every OpenAI-compatible subscription
+// model (MiniMax, GLM, Qwen) answered "model is not available on this client
+// protocol" there. Do not point the CLI at the separate `/v1/responses` SDK
+// front door either; the gateway may shape that body differently.
+export const CODEX_CLI_BASE_PATH = "/openai/v1";
 export const impelCodexBaseUrl = (gatewayUrl) => `${gatewayUrl}${CODEX_CLI_BASE_PATH}`;
 
 const START_MARK = `# >>> ${RUNTIME_BRAND.cli.managedMarker} managed block (model_providers.${PROVIDER_ID}) >>>`;
@@ -79,6 +84,10 @@ function providerTablesBlock(
     `name = ${JSON.stringify(`${RUNTIME_BRAND.product.displayName} Gateway`)}`,
     `base_url = "${baseUrl}"`,
     `wire_api = "responses"`,
+    // The gateway serves Responses over HTTPS only. Without this pin Codex
+    // dials wss://.../responses first and retries the handshake five times
+    // (surfacing each refusal to the user) before falling back to HTTPS.
+    `supports_websockets = false`,
     "",
     `[model_providers.${PROVIDER_ID}.auth]`,
     `command = ${JSON.stringify(auth.command)}`,

package/src/commands/auth.js

@@ -3,7 +3,6 @@ import {
   loadConfig,
   CONFIG_PATH,
   saveConfig,
-  foreignChannelOrigin,
   normalizeGatewayUrl,
   resolveDefaultGateway,
   resolveDefaultAppUrl,
@@ -13,8 +12,7 @@ import { promptSecret } from "../prompt.js";
 import { applyCliUser, fetchTenants, normalizeTenantId } from "../tenants.js";
 import { RUNTIME_BRAND } from "../runtimeBrand.js";
 
-export async function cmdAuth(argv, overrides = {}) {
-  const io = { fetchTenants, promptSecret, ...overrides };
+export async function cmdAuth(argv) {
   const { flags } = parseFlags(argv, {
     pat: { type: "string" },
     gateway: { type: "string" },
@@ -22,16 +20,11 @@ export async function cmdAuth(argv, overrides = {}) {
     tenant: { type: "string" },
   });
 
-  // `auth` is the one command that must run against a config whose origins
-  // belong to another channel: it is how a device that carried a production
-  // config is moved onto the canary origins (and the message `loadConfig`
-  // prints elsewhere tells the tester to run it).
-  const canary = RUNTIME_BRAND.channel === "canary";
-  const existing = loadConfig({ rejectForeignOrigins: !canary });
+  const existing = loadConfig();
 
   let pat = flags.pat;
   if (!pat) {
-    pat = await io.promptSecret(`${RUNTIME_BRAND.product.displayName} Personal Access Token (${RUNTIME_BRAND.auth.patPrefix}...): `);
+    pat = await promptSecret(`${RUNTIME_BRAND.product.displayName} Personal Access Token (${RUNTIME_BRAND.auth.patPrefix}...): `);
   }
   if (!pat) {
     console.error("impel: no PAT provided, aborting.");
@@ -44,21 +37,12 @@ export async function cmdAuth(argv, overrides = {}) {
     );
   }
 
-  // Under the canary brand the stored origins are ignored in favour of the
-  // brand defaults; a production origin can only survive here if it is asked
-  // for explicitly, and then it is refused below rather than written.
-  const gatewayUrl = normalizeGatewayUrl(flags.gateway || (canary ? null : existing?.gatewayUrl) || resolveDefaultGateway());
-  const appUrl = normalizeGatewayUrl(flags.app || (canary ? null : existing?.appUrl) || resolveDefaultAppUrl());
-  for (const [key, value] of [["gatewayUrl", gatewayUrl], ["appUrl", appUrl]]) {
-    const expected = foreignChannelOrigin(key, value);
-    if (expected) {
-      throw new Error(`${key} ${value} is not a ${RUNTIME_BRAND.channel} origin; this ${RUNTIME_BRAND.channel} build talks only to ${expected}.`);
-    }
-  }
+  const gatewayUrl = normalizeGatewayUrl(flags.gateway || existing?.gatewayUrl || resolveDefaultGateway());
+  const appUrl = normalizeGatewayUrl(flags.app || existing?.appUrl || resolveDefaultAppUrl());
 
   const config = { ...(existing || {}), pat, gatewayUrl, appUrl, updatedAt: new Date().toISOString() };
   try {
-    const listing = await io.fetchTenants(config);
+    const listing = await fetchTenants(config);
     const requestedTenant = flags.tenant ? normalizeTenantId(flags.tenant) : null;
     const selected = requestedTenant
       ? listing.tenants.find((tenant) => tenant.id === requestedTenant || tenant.slug === requestedTenant)

package/src/commands/update.js

@@ -15,7 +15,7 @@ import {
   convergenceSummaryDiagnostics,
   readRecentConvergenceSummary,
 } from "../convergenceSummary.js";
-import { brandedEnvironmentName, brandedText, RUNTIME_BRAND, versionLine } from "../runtimeBrand.js";
+import { brandedEnvironmentName, brandedText, RUNTIME_BRAND } from "../runtimeBrand.js";
 import { IMPEL_CLI_ENTRYPOINT } from "../selfInvocation.js";
 import {
   fetchRemoteVersion,
@@ -68,9 +68,7 @@ export function postInstallCliRunnable(expectedVersion, { spawn = spawnSync, exe
       windowsHide: true,
     });
     if (run.status !== 0 || run.error) return false;
-    // The freshly installed build is the same package on the same channel, so
-    // its `--version` line carries the same channel suffix this build prints.
-    return String(run.stdout || "").trim() === versionLine(expectedVersion.trim());
+    return String(run.stdout || "").trim() === expectedVersion.trim();
   } catch {
     return false;
   }

package/src/config.js

@@ -47,39 +47,8 @@ export function normalizeGatewayUrl(url) {
   return LEGACY_GATEWAY_URLS.has(normalized) ? DEFAULT_GATEWAY_URL : normalized;
 }
 
-const CHANNEL_ORIGIN_KEYS = Object.freeze({
-  gatewayUrl: Object.freeze({ brandDefault: DEFAULT_GATEWAY_URL, environmentSuffix: "GATEWAY_URL" }),
-  appUrl: Object.freeze({ brandDefault: DEFAULT_APP_URL, environmentSuffix: "APP_URL" }),
-});
-
-/**
- * Under the canary brand, an origin the CLI would use must be the canary row
- * the brand carries, or the explicit branded env override (how an engineer
- * points a build at a local service). Returns the origin `key` is required to
- * be when `value` is foreign, else null. The stable brand accepts every
- * origin, exactly as before channels existed.
- *
- * Why this exists: the canary CLI replaces the stable one on a device under
- * the same package name, so an engineer's existing production config would
- * otherwise keep a canary build talking to production with production
- * credentials (R17).
- */
-export function foreignChannelOrigin(key, value) {
-  if (RUNTIME_BRAND.channel !== "canary" || !value) return null;
-  const { brandDefault, environmentSuffix } = CHANNEL_ORIGIN_KEYS[key];
-  const normalized = normalizeGatewayUrl(value);
-  const override = process.env[brandedEnvironmentName(environmentSuffix)];
-  if (normalized === brandDefault || (override && normalized === normalizeGatewayUrl(override))) return null;
-  return brandDefault;
-}
-
-/**
- * Returns the parsed config object, or null if it doesn't exist yet. Throws
- * on malformed JSON, and — under the canary brand — on a stored origin outside
- * the canary row unless `rejectForeignOrigins` is false (`impel auth` reads
- * that way so it can move a device off a production config).
- */
-export function loadConfig({ rejectForeignOrigins = true } = {}) {
+/** Returns the parsed config object, or null if it doesn't exist yet. Throws on malformed JSON. */
+export function loadConfig() {
   let raw;
   try {
     raw = fs.readFileSync(CONFIG_PATH, "utf8");
@@ -87,27 +56,15 @@ export function loadConfig({ rejectForeignOrigins = true } = {}) {
     if (err.code === "ENOENT") return null;
     throw err;
   }
-  let config;
   try {
-    config = JSON.parse(raw);
+    const config = JSON.parse(raw);
+    if (config?.gatewayUrl) config.gatewayUrl = normalizeGatewayUrl(config.gatewayUrl);
+    return config;
   } catch {
     throw new Error(
       `${CONFIG_PATH} exists but isn't valid JSON. Fix or delete it, then run \`${RUNTIME_BRAND.cli.command} auth\` again.`
     );
   }
-  if (config?.gatewayUrl) config.gatewayUrl = normalizeGatewayUrl(config.gatewayUrl);
-  if (rejectForeignOrigins) {
-    for (const key of Object.keys(CHANNEL_ORIGIN_KEYS)) {
-      const expected = foreignChannelOrigin(key, config?.[key]);
-      if (expected) {
-        throw new Error(
-          `${CONFIG_PATH} stores ${key} ${normalizeGatewayUrl(config[key])}, but this ${RUNTIME_BRAND.channel} build talks only to ${expected}; `
-          + `run \`${RUNTIME_BRAND.cli.command} auth\` to re-enrol this device against the ${RUNTIME_BRAND.channel} origins.`
-        );
-      }
-    }
-  }
-  return config;
 }
 
 /** Writes the config atomically-ish and locks it down to 0600 (owner read/write only). */

package/src/extension/index.js

@@ -1,7 +1,7 @@
 import path from "node:path";
 
 import { main as upstreamMain } from "../cli.js";
-import { brandedText, RUNTIME_BRAND, validateRuntimeBrand, versionLine } from "../runtimeBrand.js";
+import { brandedText, RUNTIME_BRAND, validateRuntimeBrand } from "../runtimeBrand.js";
 
 const ALIASES = Object.freeze({
   apps: "app",
@@ -95,7 +95,7 @@ export function createImpelCliExtension({ brand, entrypoint, version }) {
         return;
       }
       if (["--version", "-v"].includes(rawCommand)) {
-        process.stdout.write(`${versionLine(version)}\n`);
+        process.stdout.write(`${version}\n`);
         return;
       }
       const command = ALIASES[rawCommand] || rawCommand;

package/src/gateway/index.js

@@ -328,6 +328,7 @@ export function createGatewayCli(options) {
       `name = ${JSON.stringify(`${brand.product.displayName} Gateway`)}`,
       `base_url = ${JSON.stringify(gatewayRoutes.codex(gatewayUrl))}`,
       'wire_api = "responses"',
+      "supports_websockets = false",
       "",
       `[model_providers.${brand.cli.providerId}.auth]`,
       `command = ${JSON.stringify(auth.command)}`,

package/src/managedProfileVersion.js

@@ -17,4 +17,9 @@
 // v47 persists `features.apps = false` in the managed ChatGPT desktop profile
 // so the hosted codex_apps connector stops handshaking against the gateway
 // without a credential (the same gate 0.20.61 passed to CLI sessions).
-export const CURRENT_CONFIG_VERSION = 47;
+// v48 moves the isolated CLI Codex provider from the raw
+// `/chatgpt_passthrough/backend-api/codex` route (Codex-native models only) to
+// the typed `/openai/v1` route the managed ChatGPT desktop profile uses, and
+// pins `supports_websockets = false` so Codex stops retrying a wss://
+// handshake the gateway refuses before every HTTPS turn.
+export const CURRENT_CONFIG_VERSION = 48;

package/src/posthog.js

@@ -101,7 +101,7 @@ export const TELEMETRY_CONTRACT = Object.freeze({
       name: "cli_bug_report",
       origin: "server",
       properties: [
-        { key: "channel", type: "string", required: true, values: ["latest", "next", "canary"] },
+        { key: "channel", type: "string", required: true, values: ["latest", "next"] },
         { key: "cliVersion", type: "string", required: true, maxLength: 32 },
         { key: "hasMessage", type: "boolean", required: true },
         {
@@ -123,7 +123,7 @@ export const TELEMETRY_CONTRACT = Object.freeze({
       name: "cli_command_run",
       origin: "cli",
       properties: [
-        { key: "channel", type: "string", required: true, values: ["latest", "next", "canary"] },
+        { key: "channel", type: "string", required: true, values: ["latest", "next"] },
         { key: "cliVersion", type: "string", required: true, maxLength: 32 },
         { key: "command", type: "string", required: true, maxLength: 64 },
         {

package/src/runtimeBrand.js

@@ -14,48 +14,22 @@ const SUPPORTED_COMMANDS = new Set([
   "models", "agents", "update", "use", "experimental",
 ]);
 
-/**
- * The closed per-channel origin row (canary release cycle, KTD9).
- *
- * A brand names its channel and every default origin must be that channel's
- * row: a canary build pointed at production, or a stable build pointed at
- * dev, is rejected at validation. `channel` is absent from the shipped
- * source's third-party brands and defaults to `stable`, which constrains
- * nothing beyond "not the canary row" so embedders' own origins stay valid.
- * `scripts/bake-canary-brand.mjs` rewrites DEFAULT below to the canary row at
- * publish time; the literals there are what it substitutes.
- */
-export const CHANNEL_ORIGINS = Object.freeze({
-  stable: Object.freeze({
-    gateway: "https://gateway.useimpel.com",
-    sessions: "https://sessions.useimpel.com",
-    controlPlane: "https://www.useimpel.com",
-  }),
-  canary: Object.freeze({
-    gateway: "https://gateway.dev.useimpel.com",
-    sessions: "https://sessions.dev.useimpel.com",
-    controlPlane: "https://next.dev.useimpel.com",
-  }),
-});
-const CANARY_ORIGIN_SET = new Set(Object.values(CHANNEL_ORIGINS.canary));
-
 const DEFAULT = Object.freeze({
   schemaVersion: 1,
-  channel: "canary",
   product: Object.freeze({ id: "impel", displayName: "Impel" }),
   cli: Object.freeze({
     command: "impel",
     packageName: "impel-cli",
-    configNamespace: "impel-canary",
+    configNamespace: "impel",
     providerId: "impel",
     managedMarker: "impel-cli",
     environmentPrefix: "IMPEL",
   }),
   auth: Object.freeze({ patPrefix: "impel_pat_", tenantPrefix: "impel_tenant_" }),
   tenant: Object.freeze({ defaultId: null, displayName: null }),
-  gateway: Object.freeze({ defaultOrigin: "https://gateway.dev.useimpel.com" }),
-  sessions: Object.freeze({ defaultOrigin: "https://sessions.dev.useimpel.com" }),
-  controlPlane: Object.freeze({ defaultOrigin: "https://next.dev.useimpel.com" }),
+  gateway: Object.freeze({ defaultOrigin: "https://gateway.useimpel.com" }),
+  sessions: Object.freeze({ defaultOrigin: "https://sessions.useimpel.com" }),
+  controlPlane: Object.freeze({ defaultOrigin: "https://www.useimpel.com" }),
   updates: Object.freeze({ registry: null }),
   apps: Object.freeze({
     displayPrefix: "Impel",
@@ -100,32 +74,10 @@ function pathSegment(name, value) {
   return result;
 }
 
-function channel(value) {
-  if (value == null) return "stable";
-  if (value === "stable" || value === "canary") return value;
-  throw new Error("impel-cli runtime brand channel must be stable or canary");
-}
-
-/** Validate one default origin against the brand's channel row (R10). */
-function channelOrigin(name, value, brandChannel) {
-  const normalized = origin(name, value);
-  const column = name.split(".")[0];
-  if (brandChannel === "canary") {
-    const expected = CHANNEL_ORIGINS.canary[column];
-    if (normalized !== expected) {
-      throw new Error(`impel-cli runtime brand ${name} must be ${expected} on the canary channel`);
-    }
-  } else if (CANARY_ORIGIN_SET.has(normalized)) {
-    throw new Error(`impel-cli runtime brand ${name} is a canary origin; the stable channel must not carry it`);
-  }
-  return normalized;
-}
-
 export function validateRuntimeBrand(input) {
   if (!input || Array.isArray(input) || typeof input !== "object" || input.schemaVersion !== 1) {
     throw new Error("impel-cli runtime brand schemaVersion must be 1");
   }
-  const brandChannel = channel(input.channel);
   const command = text("cli.command", input.cli?.command, SAFE_ID);
   const packageName = text("cli.packageName", input.cli?.packageName || command, SAFE_PACKAGE);
   if (path.isAbsolute(packageName)) throw new Error("impel-cli runtime brand cli.packageName is invalid");
@@ -140,7 +92,6 @@ export function validateRuntimeBrand(input) {
   }
   return Object.freeze({
     schemaVersion: 1,
-    channel: brandChannel,
     product: Object.freeze({
       id: text("product.id", input.product?.id, SAFE_ID),
       displayName: text("product.displayName", input.product?.displayName),
@@ -161,15 +112,14 @@ export function validateRuntimeBrand(input) {
       defaultId: defaultTenant,
       displayName: input.tenant?.displayName == null ? defaultTenant : text("tenant.displayName", input.tenant.displayName),
     }),
-    gateway: Object.freeze({ defaultOrigin: channelOrigin("gateway.defaultOrigin", input.gateway?.defaultOrigin, brandChannel) }),
+    gateway: Object.freeze({ defaultOrigin: origin("gateway.defaultOrigin", input.gateway?.defaultOrigin) }),
     sessions: Object.freeze({
-      defaultOrigin: channelOrigin(
+      defaultOrigin: origin(
         "sessions.defaultOrigin",
         input.sessions?.defaultOrigin || input.gateway?.defaultOrigin,
-        brandChannel,
       ),
     }),
-    controlPlane: Object.freeze({ defaultOrigin: channelOrigin("controlPlane.defaultOrigin", input.controlPlane?.defaultOrigin, brandChannel) }),
+    controlPlane: Object.freeze({ defaultOrigin: origin("controlPlane.defaultOrigin", input.controlPlane?.defaultOrigin) }),
     updates: Object.freeze({
       registry: input.updates?.registry == null
         ? null
@@ -208,15 +158,6 @@ export function brandedEnvironmentName(suffix) {
   return `${RUNTIME_BRAND.cli.environmentPrefix}_${suffix}`;
 }
 
-/**
- * The line `--version` prints. Off the stable channel it names the channel so
- * a tester can tell a canary process from a stable one at a glance (R8); the
- * stable output is the bare version, byte-identical to before channels existed.
- */
-export function versionLine(version) {
-  return RUNTIME_BRAND.channel === "stable" ? String(version) : `${version} (${RUNTIME_BRAND.channel})`;
-}
-
 export function brandedText(value) {
   return String(value)
     .replaceAll("impel-cli", `${RUNTIME_BRAND.cli.command}-cli`)

package/src/updates.js

@@ -36,22 +36,13 @@ export function updateRegistry() {
   ).replace(/\/+$/u, "");
 }
 
-/** The closed set of npm dist-tags the CLI can follow. */
-export function normalizeUpdateTag(tag) {
-  if (tag === "latest" || tag === "next" || tag === "canary") return tag;
+function normalizeUpdateTag(tag) {
+  if (tag === "latest" || tag === "next") return tag;
   throw new Error(`unsupported npm update tag "${tag}"`);
 }
 
-/**
- * Keep prerelease installs on npm's prerelease channel.
- *
- * A canary build is keyed on the brand channel rather than its version
- * string: `<patch+1>-canary.<N>` is a prerelease, but it must follow the
- * `canary` dist-tag, not `next` — and under the stable brand that same
- * version is only ever a prerelease that follows `next`.
- */
+/** Keep prerelease installs on npm's prerelease channel. */
 export function updateTagForVersion(version) {
-  if (RUNTIME_BRAND.channel === "canary") return "canary";
   const parsed = validVersion(version) ? version.match(VERSION_RE) : null;
   return parsed?.[4] ? "next" : "latest";
 }

package/scripts/bake-canary-brand.mjs

@@ -1,92 +0,0 @@
-#!/usr/bin/env node
-// Bake the canary channel into the runtime brand (canary release cycle, KTD7).
-//
-// `publish-canary.yml` runs this in the working tree immediately before
-// `pnpm pack`, after the test suite has run on the unmodified tree. It
-// rewrites the brand DEFAULT in `src/runtimeBrand.js` in place: the channel
-// literal becomes `canary`, the three production `defaultOrigin` literals
-// become the canary row of CHANNEL_ORIGINS (read from the very module being
-// baked so the row has one source of truth), and the CLI config namespace
-// becomes `impel-canary` so stable and canary state never share files.
-//
-// It is a one-shot publish step, not a formatter: every literal it replaces
-// must occur exactly once in its shipped form, a file that is already baked
-// is refused, and the result is re-imported and validated before the script
-// exits 0 — a half-baked or doubly-baked tree can never be packed.
-//
-// Usage: node scripts/bake-canary-brand.mjs [path/to/runtimeBrand.js]
-
-import fs from "node:fs";
-import path from "node:path";
-import { fileURLToPath, pathToFileURL } from "node:url";
-
-const DEFAULT_TARGET = fileURLToPath(new URL("../src/runtimeBrand.js", import.meta.url));
-const CANARY_MARKER = 'channel: "canary",';
-
-function fail(message) {
-  process.stderr.write(`bake-canary-brand: ${message}\n`);
-  process.exit(1);
-}
-
-/** Import `target` fresh (never from this process's module cache) with no brand in the environment. */
-async function importBrandModule(target, cacheBuster) {
-  // The module reads IMPEL_CLI_RUNTIME_BRAND at import time; the bake is about
-  // the DEFAULT, so an inherited brand must not stand in for it.
-  delete process.env.IMPEL_CLI_RUNTIME_BRAND;
-  return import(`${pathToFileURL(target).href}?bake=${cacheBuster}`);
-}
-
-function replaceExactlyOnce(source, from, to) {
-  const occurrences = source.split(from).length - 1;
-  if (occurrences !== 1) {
-    fail(`expected exactly one occurrence of ${JSON.stringify(from)} in the brand source, found ${occurrences}`);
-  }
-  return source.replace(from, to);
-}
-
-async function main() {
-  const target = path.resolve(process.argv[2] || DEFAULT_TARGET);
-  const original = fs.readFileSync(target, "utf8");
-  if (original.includes(CANARY_MARKER)) fail(`${target} is already baked for the canary channel`);
-
-  const { CHANNEL_ORIGINS } = await importBrandModule(target, "before");
-  const rows = [
-    ['channel: "stable",', CANARY_MARKER],
-    ['configNamespace: "impel",', 'configNamespace: "impel-canary",'],
-    ...["gateway", "sessions", "controlPlane"].map((column) => [
-      `defaultOrigin: ${JSON.stringify(CHANNEL_ORIGINS.stable[column])}`,
-      `defaultOrigin: ${JSON.stringify(CHANNEL_ORIGINS.canary[column])}`,
-    ]),
-  ];
-  let baked = original;
-  for (const [from, to] of rows) baked = replaceExactlyOnce(baked, from, to);
-
-  // Atomic replace, then prove the result by importing it: the DEFAULT must
-  // now be the canary row and must pass the validator's own channel check.
-  const temporary = `${target}.bake-${process.pid}`;
-  fs.writeFileSync(temporary, baked, { mode: fs.statSync(target).mode & 0o777 });
-  fs.renameSync(temporary, target);
-  try {
-    const { RUNTIME_BRAND, validateRuntimeBrand } = await importBrandModule(target, "after");
-    validateRuntimeBrand(RUNTIME_BRAND);
-    const mismatch = ["gateway", "sessions", "controlPlane"].find((column) => (
-      RUNTIME_BRAND[column].defaultOrigin !== CHANNEL_ORIGINS.canary[column]
-    ));
-    if (RUNTIME_BRAND.channel !== "canary" || mismatch) {
-      throw new Error(`baked DEFAULT is not the canary row (${mismatch || "channel"})`);
-    }
-    if (RUNTIME_BRAND.cli.configNamespace !== "impel-canary") {
-      throw new Error(`baked CLI config namespace is not isolated (${RUNTIME_BRAND.cli.configNamespace})`);
-    }
-    process.stdout.write(
-      `bake-canary-brand: ${target} now carries channel canary `
-      + `(gateway ${RUNTIME_BRAND.gateway.defaultOrigin}, sessions ${RUNTIME_BRAND.sessions.defaultOrigin}, `
-      + `controlPlane ${RUNTIME_BRAND.controlPlane.defaultOrigin}, config ${RUNTIME_BRAND.cli.configNamespace})\n`,
-    );
-  } catch (error) {
-    fs.writeFileSync(target, original);
-    fail(`baked brand failed verification and was restored: ${error?.message || error}`);
-  }
-}
-
-await main();